Automatic port forwarding: restrict to 127.0.0.1 on the host

[zcutlip]

Colima's automatic port forwarding is very convenient, requiring no additional configuration. But I would like to restrict what interfaces or addresses on the host those ports are reachable on.

For example, I have a postfix container that allows me to reach 127.0.0.1:25 from the host. But now I can also reach port 25 on the host from other physical machines on the network.

Is there a way to restrict the port forwarding to only the host's loopback interface and/or address?

[zcutlip]

I can configure postfix to restrict itself to only certain address ranges, which I have done. But I really need the port to not even be reachable from the host's physical network

[abiosoft]

You can specify 127.0.0.1 in the port mapping for docker run or docker compose file.

The following will only be reachable on port 8080 on the host.

docker run --rm -it -p 127.0.0.1:8080:80 caddy

[zcutlip]

Hmm yes I was doing that in my compose file with:

ports:
    - 127.0.0.1:25:25

and it was still listening on *.25 on the host:

netstat -an | grep LISTEN
tcp4       0      0  *.25                   *.*                    LISTEN

I changed to 2525 and for some reason that works, binding it to 127.0.0.1:

netstat -an | grep LISTEN

tcp4       0      0  127.0.0.1.2525         *.*                    LISTEN

[abiosoft]

Interesting, I am not sure what's going on there.
Maybe privileged ports are handled somewhat differently.

[zcutlip]

Okay, thanks for your help! I can close this discussion now, unless you're planning on looking into the issue further.